Security readout for executives and security teams
Plain-English summary
A timing flaw in Linux's CAN Broadcast Manager lets a local, low-privileged user race frame-sequence updates against kernel timer processing. The demonstrated result is a kernel out-of-bounds read; the supplied score also anticipates serious confidentiality and availability impact. It is not described as remotely exploitable.
Executive priority
Prioritize shared or multi-user Linux systems where CAN BCM is available. Local access is required, reducing internet-scale urgency, but the high CVSS score and potential kernel confidentiality and availability effects justify expedited patching. Isolated systems without untrusted local access can follow accelerated maintenance.
Technical view
Userspace can modify a BCM transmit sequence and reset currframe while bcm_can_tx() runs in hrtimer context. Missing synchronization can make currframe or count inconsistent with sequence storage, producing a KASAN-detected slab out-of-bounds read. Referenced fixes add spin_lock_bh protection and move count handling inside the locked section.
Likely exposure
Linux systems running an affected or unpatched vendor kernel with CAN BCM available and accessible to local low-privileged users are most exposed. The bundle lists versions from 2.6.25 through multiple branches up to 6.15, but distribution backports can change status; confirm using vendor package records.
Exploitation context
A researcher-developed proof of concept triggered the KASAN fault. The bundle marks KEV false and provides no evidence of active exploitation. It does not establish reliable privilege escalation or code execution; those outcomes remain unproven.
Researcher notes
No CWE is assigned. The strongest direct evidence is a KASAN slab out-of-bounds read caused by concurrent updates involving currframe and count. The fix addresses synchronization using spin_lock_bh. Exact affected package builds and backport status require per-distribution verification.
Mitigation direction
- Install a distribution or vendor kernel containing the applicable referenced stable fix.
- Reboot affected systems so the corrected kernel is active.
- If patching is delayed, restrict untrusted local access and consult vendor guidance for supported CAN BCM mitigations.
- For Debian LTS systems, review the cited advisories and apply the vendor-provided security update.
Validation and detection
- Inventory running kernel packages and identify hosts where CAN BCM is available.
- Map each build to vendor security notices or backport records; do not rely only on upstream version numbers.
- Confirm the applicable stable locking commit is present in deployed kernel source or vendor changelogs.
- After rebooting, verify the expected kernel is running and regression-test legitimate CAN BCM workloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38004 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4CVE reference, Linux
- https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628CVE reference, Linux
- https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1fCVE reference, Linux
- https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6CVE reference, Linux
- https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645eCVE reference, Linux
- https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0CVE reference, Linux
- https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbdCVE reference, Linux
- https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.